Lucene search

GitHub_MCVELIST:CVE-2020-15141

HistoryAug 14, 2020 - 4:20 p.m.

CVE-2020-15141 Path Traversal in openapi-python-client

2020-08-1416:20:19

CWE-22

GitHub_M

www.cve.org

3 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.7%

JSON

In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.

CNA Affected

[
  {
    "product": "openapi-python-client",
    "vendor": "triaxtec",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.5.3"
      }
    ]
  }
]

References

github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13

github.com/triaxtec/openapi-python-client/commit/3e7dfae5d0b3685abf1ede1bc6c086a116ac4746

github.com/triaxtec/openapi-python-client/security/advisories/GHSA-7wgr-7666-7pwj

pypi.org/project/openapi-python-client

3 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.7%

JSON

Related for CVELIST:CVE-2020-15141